Complementarity, distillable secret key, and distillable entanglement 
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We consider controllability of two conjugate observables Z and X by two parties with classical 
communication. The ability is specified by two alternative tasks, (i) agreement on Z and (ii) 
preparation of an eigenstate of X with use of an extra communication channel. We prove that their 
feasibility is equivalent to that of key distillation if the extra channel is quantum, and to that of 
entanglement distillation if it is classical. This clarifies the distinction between two entanglement 
measures, distillable key and distillable entanglement. 

PACS numbers: 03.67.Dd 03.65.Ud 03.67.-a 



When two remote parties Alice and Bob want to com- 
municate a message over a public channel without dis- 
closing it to a third party Eve, it is sufficient for them 
to have a resource called a (secret) key, which is a ran- 
dom number that is shared by Alice and Bob secretly 
from Eve. In quantum mechanics, a (log(i)-bit key is 
described by a tripartite state 
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with arbitrary state pe, where we assume Hilbert space 
TIa®'Hb®'He of systems held by the three parties, with 
a standard basis for Ha and for Hb- Quan- 

tum key distribution (QKD) protocols enable production 
of the key through communication over a quantum chan- 
nel and an authenticated public channel. Strictly speak- 
ing, they do not provide the state tab e but a state pabe 
very close to tabe- The imperfection is often measured 
0, Q using the trace norm as 
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It is not an easy task to bound 6^ ey against Eve with 
unconditional power by considering all of her options in a 
QKD protocol. Hence we often invoke the fact that Alice 
and Bob could have done a different (virtual) protocol 
instead of the actual protocol, at least from Eve's point 
of view. 

One of successful approaches [3|is to take an entangle- 
ment distillation protocol (EDP) [4] as the virtual proto- 
col, which tries to produce a (log d)-ebit maximally en- 
tangled state (MES) 
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Once its feasibility is proved, the security of the QKD 
protocol immediately follows since the task of entangle- 
ment distillation is stronger than that of key distillation 



0, E|. In fact, rather unexpectedly, it was shown 
that it is often strictly stronger, and distillable entan- 
glement Ed(pab) is strictly smaller than distillable key 
Kd{pab)- This implies that the security of a QKD proto- 
col is not necessarily provable by a reduction to an EDP, 
and distillation of a wider class of states were proposed 
to restore the applicability 0, • 

On the other hand, the first proof of unconditional 
security by Mayers _Sj took a quite different approach. 
He considered a virtual protocol concerning an observ- 
able that is "conjugate" to the key. In contrast to the 
EDP approach, here neither the real protocol nor the 
virtual one alone can prove the security. Security follows 
from the fact that Alice and Bob can freely choose be- 
tween the two protocols, which cannot be executed at 
the same time. This complementarity approach has been 
refined 0, [Toj ] to achieve the simplicity comparable to 
the EDP approach. In addition, it has a unique practical 
advantage of low demand on the characterization of ap- 
paratuses. Recently, this has lead to the security proof 
of efficient QKDs using practical sources and detectors 
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In this paper, we first show that this complementarity 
scenario is not merely a tool to prove the security, but 
it captures exactly what the key distillation is, by prov- 
ing that there exists a corresponding complementarity 
task whenever key can be distilled. Then we also show 
that a slightly different complementarity task, aimed at 
the same goal but with the available resource restricted, 
is equivalent to entanglement distillation. These results 
imply that the distillable key Kd(pab) and the distil- 
lable entanglement Eo(pab) have nice alternative defi- 
nitions in the complementarity scenario, which clarifies 
the physical meaning of the difference between the two 
quantities. 

We first formulate the complementarity scenario es- 
sentially used in the latest version [l(| of the security ar- 
guments, which here we call complementary control of a 
(log d)-bit observable. We consider a pair of protocols, the 
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primary and the secondary, between which Alice and Bob 
can choose to execute. The two protocols are roughly de- 
scribed as follows. In the primary protocol, they commu- 
nicate over a classical channel, and then Alice measures 
a (logd)-bit local observable Z, while Bob tries to guess 
its outcome. In the secondary protocol, they perform the 
same classical communication, but after that Alice tries 
to prepare an eigenstatc of an observable X, which is 
conjugate of Z. In doing so, we allow Bob to help Alice 
through an extra quantum (or classical) channel. 

More precisely, we require that the choice between 
the alternative protocols can be postponed after the 
end of the classical communication. At this point, we 
assume that the standard basis {\i) A}i=o,....d-i of Ha 
corresponds to the observable Z. If they choose the 
primary protocol, Alice measures Ha (system A) on 
A}i=o,...,d—i and Bob conducts a local operation on his 
entire systems, resulting in the state of systems AB be- 
ing ^2ijPij \ij)(ij\AB- The error in this protocol is given 

by 
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If they choose the secondary protocol, Alice and Bob co- 
operate over the extra channel in order to prepare system 
A in state \0x)a = d^ 1 ^ 2 \i)a- When they end up in 
state a a, we define its error by 
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Of course, it would be meaningless if we allowed Alice to 
discard the contents of system A and prepare |0x)yt from 
scratch. In order to claim that they really have created 
an eigenstate of X , conjugate of Z, we require that their 
operation over the extra channel should commute with 
the observable Z, namely, it preserves every eigenstate 
\j) A- We call it the nondisturbing condition. 

We now show two theorems implying that this scenario 
is essentially equivalent to key distillation, as depicted in 
Fig. 1. In the proofs, we use the fidelity F{p,a) = 
|| y/py^W 2 as well as the trace distance. Both measures 
are monotone under quantum operations, and they are 
related by 2(1 - y/f) < \\p - a\\ < 2yT^T [14]. The 
fidelity is useful because of the existence of extensions 
\<j) p ) and \4>cr) satisfying |(</> P |</> CT )| 2 = F, whereas the trace 
distance obeys the triangle inequality. Eq. ([5]) can be 
written as F(a A , \0x)(0x\a) = 1-S X . 

The security argument in [lCj is essentially given by 
the following theorem. 

Theorem 1. If complementary control of a (log(i)-bit 
observable with errors Sz and S x is possible with an ex- 
tra quantum channel, then the primary protocol yields a 
(logd)-bit key with imperfection S^ ey < 2$z + 2\/Sx ■ 

Proof. Suppose that Alice and Bob run the primary or 
the secondary protocol in the presence of Eve, leading to 
the final states pabe = Pij\ij){ij\AB ® P% 3) or a A E, 
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FIG. 1: Equivalence between complementary control with an 
extra quantum channel and key distillation. 



respectively. Suppose that, after the secondary protocol, 
(a) we measure system A on the basis {|«)a} to obtain 
o' AE = Qi |*) (i\A ® Pe i an d then (b) copy the outcome 
onto system B, resulting in o' ABE = J2i <ZiK*) (m|ab® Pe '■ 
We will show that pabe and tabe are both close to 
°'abe- 

Since a a = T^e&ae satisfies Eq. ([5]), there exists a 
state t A e = \0x){0x\a ® Pe with F{o- A e,t A e) = 1 - 
Sx, and hence \\ctae — t ae\\ < ^VSx- If we apply the 
steps (a) and (b) to state tae, the final state is an ideal 
key tabe = d^ 1 £V \H)(H\ab ® Pe- Therefore " 
tare || < ZVSx- 

Thanks to the nondisturbing condition, 



ABE 



a AE 



Tib(pabe), and hence o' ABE = J].. Pij\ii)(ii\AB 



(ij) 

Then, direct calculation leads to ||ct^ B£; — Pabe II = 2(5z, 
proving Theorem 1. 

Next, we show that the opposite direction is also true 
if there is no restriction to Eve's power. Here, we as- 
sume the following for Eve with no restriction. Let us 
represent the entire data transmitted over the public 
communication by variable to. We assume that Alice, 
Bob, and Eve each has the record of u, and hence He 



is decomposed as He = 



In principle, by us- 



ing large auxiliary systems A' and B' , Alice and Bob 
can do the same key distillation coherently without dis- 
carding any subsystems. We assume that Eve can col- 
lect everything that is not possessed by Alice and Bob. 
This ensures that the final state for a particular value 
of ui is a pure state \&p)abea>b>, and the overall state 
is Pabea'B' = ®wPw|$p )($p I- Tracing out systems 
A'B' gives state pabe = QuPuPabe- 

Now we can prove the following theorem. 
Theorem 2. If a (logd)-bit key with imperfection f5k ey 
can be distilled against Eve with no restriction, then com- 
plementary control of a (log d)-bit observable with an ex- 
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tra quantum channel is possible with errors 5z < <5key/2 
and S x < S kcy - (S kcy /2) 2 . 

Proof. We regard the key distillation protocol as the 
primary protocol. Then Sz < <5key/2 is trivial. Be- 
fore stating the secondary protocol, we need the follow- 
ing observations. In the assumption \\pabe — TAbe|| = 
<5kcy, tabe may not be a direct sum over u>. But we 

can define such a state t' abe = ©wpL t abb by a P~ 
plying decoherence to tabe- Since the same decoher- 
ence operation does not alter pabe, we have \\pabe — 
t'abeW < <W, or F(p A BE, t' abe ) > (1 - <W/2) 2 . 
Then, there exists an extension of t' abe taking the 

form of t' abea , b , = ® u p'J®T )(®t \ABEA'B>, satisfy- 
ing F(pABEA'B',T A BEA>B>) > (1 - 4oy/2) 2 . 



Since r 
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must be written in the form of e?~ 1//2 J2i l^A^i )A'BB'E 
with Tr^/BB' \4>i) i&i I = /°b i which is independent of 
i. This implies the existence of unitaries {Ua'bb'} sa ^~ 
isfying U A "' BB ,\(t)f') A'bb'e = l^^A'BB'E- If we define 



U 



AA'BB' 



Ei|i><iU®E$ 



BB'' 



I A' 

we see 



j A'BB'E, 



where the state of system A is |0x)a- 

Hence we can construct the secondary protocol as fol- 
lows: After the coherent version of the key distillation 
protocol, using the record of u>, Alice and Bob apply 
Uaa'bb' using an extra quantum channel. The form 
of U^J/gg, obviously satisfies the nondisturbing con- 
dition. If the state after the key distillation protocol 
was t abea , b ,, the protocol would produce |0x)yi ex- 
actly. Thus, for state pabea'B 1 , the output a a should 
satisfy a(0xWa\0x) A > (1 - 4 cy /2) 2 , namely, S x < 
key — (<W/2) 2 . 

The two theorems indicate that the complementarity 
scenario is a powerful tool for QKD, namely there is no 
fundamental limitation in applying the scenario to prove 
the security of QKD protocols. They also show that dis- 
tillable key Ke>{pab) of a bipartite state pab can 
be also defined in the complementarity scenario. Let us 
introduce the asymptotic yield of complementary control 
Yq , where the subscript signifies that the extra channel is 
quantum. We define Yq(pab) to be the supremum of real 
numbers y with which the following statement holds true. 
Starting with Pab> complementary control of a (logd^)- 
bit observable is possible with errors {8* , $x )' where 
8% — > 0, 5% — > 0, and loge?„/n — > y for n — > oo. With 
this definition, Theorem 1 implies Kjj(pab) > Yq(pab) 
while Theorem 2 implies Kd(pab) < Yq(pab), leading 
to 
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Next, let us consider a slightly different scenario, in 
which Alice and Bob are allowed to communicate only 
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FIG. 2: Equivalence between complementary control with an 
extra classical channel and entanglement distillation. 



classically in the secondary protocol. Then we can find 
a close connection to distillation of the (log d)-ebit max- 
imally entangled state defined in Eq. (J3j> , as depicted in 
Fig. [21 For output state pab , we measure the imperfec- 
tion in the distillation task by 



\Pab 



' AB I 



(7) 



with 



\<fi mes )((f> mos \. Then we can prove the follow- 
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ing. 

Theorem 3. If complementary control of a (logd)-bit 
observable with errors Sz and 5x is possible with an extra 
classical channel, then it is possible to distill a (logc?)- 
ebit maximally entangled state with imperfection r5 en t < 
V$z(l 



5z) + 2^/8x. 

Proof. In the primary protocol, Alice and Bob's opera- 
tion after the classical communication can be coherently 
done by enlarging the size of systems A'B', namely, it 
can be done by a unitary operation V — Vaa< ® Vbb'- 
Let (J aa'bb 1 be the state after the application of V. The 
error 5z implies that 



Tr[Q 



cor „ 

AB° AA'BB 1 



= l-6 2 



(8) 



where Q a °b = J2i \ii)(H\AB is the projection onto the 
subspace with no errors. 

From the state (Taa'BB', Alice and Bob can undo 
the unitary by applying V , going back to the state 
just after the classical communication. From here, Al- 
ice and Bob can choose to conduct the secondary pro- 
tocol using the extra classical channel to produce state 
Pa = A(cr aa'bb'), where we write the whole quantum 
operation starting from V" 1 by a CPTP map A. The 
error 5x implies that 



\H<taa'bb')-\0x)(0x\a\\ <2a 



(9) 



We construct a distillation protocol as follows. Al- 
ice and Bob conduct the coherent version of the pri- 
mary protocol, resulting in uaa'BB' ■ Bob further uses an 
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auxiliary system C with dimension d, prepared in state 
ac = |0)(0|c- He copies the contents of system B onto 
system C by unitary : \jO) B c >-> \jj)BC, resulting 
in state 



VAA'BB'C = U C ^{(T A A>BB> ® Cc)^BC 



cpyt 



(10) 



Alice and Bob then apply A on systems AA'BB' us- 
ing the extra classical channel to achieve the final state 

P'aC = M a AA' bb'c)- 

We now prove that p' AC is close to t a u q. Consider the 
state defined by 



o'aA'BB'C = U Ac(° AA'BB' ® CT C )U A Py 



'AC 
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with U 



7S ■■ lio) 



AC 



\jj)AC- Using Eq. © and the obvi- 
ous relation U A q Qab — ^bcQab' we can snow [Ht that 
Waa'bb-c - a AA'BB'c)\\ ^ 4 a/^(1 = fe) and hence 



IIPac - AK a ,bs'c)II < 4v/fc(l-fe). (12) 

On the other hand, the nondisturbing condition implies 
that there is no difference whether we apply U A P ^ before 
or after the application of A. This leads to 

H^'aa'bb'c) = U c /S(H«aa'bb') ® <rc)V%p. (13) 
Then, using Eq. ©, we have 
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Combined with Eq. (|12p . it proves Theorem 3. 

The opposite direction is trivial, and it is stated as 
follows (proof omitted). 

Theorem 4. If a (logd)-ebit maximally entangled state 
with imperfection <5 en t can be distilled, then complemen- 
tary control of a (log <i)-bit observable with an extra clas- 
sical channel is possible with errors Sz < S cn t/2 and 

S X < <Wt ~ (Sent/2) 2 . 

If we define the asymptotic yield Yc(pab) with an ex- 
tra classical channel as we defined Yq before, Theorems 
3 and 4 lead to 



Ed( P 



AB 



Yc(pab), 



(15) 



which shows that the distillablc entanglement Ed also 
has an alternative definition in the complementarity sce- 
nario. Together with Eq. ([6]), now we see that distill- 
able key and distillable entanglement can be regarded as 
achievable yields of the same task, carried out under dif- 
ferent conditions. This gives a clear distinction between 
the two entanglement measures. Both are related to the 
potential to carry out two mutually exclusive tasks con- 
cerning a pair of conjugate observables Z and A, using 
the same classical communication. One task is to share 
the value of Z, and the other one is to drive the state into 
an eigenstate of A. The latter task naturally requires ad- 
ditional communication, and this is where the difference 



between the two quantities shows up. If we insist that it 
also must be classical and hence both tasks are feasible 
with only classical communication, the achievable size of 
the observables tallies with the distillable entanglement. 
If we place no such requirement, then the achievable size 
matches the distillable key. This may be understandable 
because if the key is actually distilled, the task for A is 
never carried out and hence there is no concern about 
what resources are required to carry it out. 

We have seen that the complementarity scenario can 
explain two of the few operationally-defined entangle- 
ment measures, which shows its significance in under- 
standing quantum entanglement. It is interesting to see 
whether we can also define yet another operationally- 
defined measure, entanglement cost 16| in a complemen- 
tarity scenario. The task of the complimentary control 
defined here is merely one of many possible ways to quan- 
tify abilities related to the concept of complementarity, 
and it is worth seeking other tasks, for example, the ones 
retaining the symmetry between two conjugate observ- 
ables. 
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